Secure Application Lifecycle – Part 1 – Using CredScan

by | Dec 14, 2020 | Technology | 0 comments

This article is contributed. See the original author and article here.

 


Cyber Security topic is one the most important topics in our mind when we develop application and systems on-perm or in cloud in general.


It is important to frequently perform and install security validations on applications. There are two important aspects for these security validations. First, developer should be able to detect any credentials or secrets in the code so developer can move them to a safe place. Also, DevOps and infrastructure team should be able to perform frequent security health checks on azure subscriptions.


In this series, I will go over very useful tools which help to improve the security of application and cloud resources. In Part 1, I will discuss CredScan. Part 2 will focus on secure DevOps Kit for Azure or AzSK and Part 3 will focus on Azure Sentinel and security health.


 


 


Managing Credentials in the Code with CredScan


 


The first aspect as we mentioned is the ability to detect any creds or secrets. Developer should be able to catch it before committing the code to Repo or during the pipeline process itself. 


We all know it is easy to leave credentials in the code, especially in large projects. Team can always try to check for credentials manually, but it is not recommended way to look for sensitive information.


Credential Scanner (aka CredScan) is a tool developed and maintained by Microsoft to identify credential leaks such as those in source code and configuration files. Some of the commonly found types of credentials are default passwords, SQL connection strings and Certificates with private keys.


There are two version of CredScan server and client side as it shows in the following diagram


 


Picture1.png


The client side


It is extension and currently support VS 2017 and you can download it from here


After installing the extension then we are ready to code and build and if our code has certain credential, the tool will catch it as following.


 


Picture2.png


The downside for the client side there is no extension for VS 2019 or VS code yet. As Alternative for developers who are interested in installing first line of defense for creds scanning please refer to my blog git secrets


 


CredScan Server Side implementation


In order to use the server side version, developer needs to include “CredScan Build” task in project pipeline. For more information about obtaining Microsoft Security Code Analysis Extension, please review this document.


 


In Azure DevOps, we can add the tasks in Classic build Editor, CredScan can be added direct using search box


 


Picture3.png


 


After adding the task, developer or DevOps engineer can fill the detail of the task


Available options include:



  • Display Name: Name of the Azure DevOps Task. The default value is Run Credential Scanner

  • Tool Major Version: Available values include CredScan V2, CredScan V1. We recommend customers to use the CredScan V2 version.

  • Output Format: Available values include TSV, CSV, SARIF, and PREfast.

  • Tool Version: We recommend you select Latest.

  • Scan Folder: The repository folder to be scanned.

  • Searchers File Type: The options for locating the searchers file that is used for scanning.

  • Suppressions File: A JSON file can suppress issues in the output log. For more information about suppression scenarios, see the FAQ section of this article.

  • Verbose Output: Self-explanatory.

  • Batch Size: The number of concurrent threads used to run Credential Scanner. The default value is 20. Possible values range from 1 through 2,147,483,647.

  • Match Timeout: The amount of time in seconds to spend attempting a searcher match before abandoning the check.

  • File Scan Read Buffer Size: The size in bytes of the buffer used while content is read. The default value is 524,288.

  • Maximum File Scan Read Bytes: The maximum number of bytes to read from a file during content analysis. The default value is 104,857,600.

  • Control Options > Run this task: Specifies when the task will run. Select Custom conditions to specify more complex conditions.

  • Version: The build task version within Azure DevOps. This option isn’t frequently used.


 


Picture4.png


In YAML Pipeline Editor, Here is example for CredScan YAML task.


 


 

parameters:
  pool: 'Hosted VS2017'
  jobName: 'credscan'
  displayName: Secret Scan

jobs:
- job: ${{ parameters.jobName }}
  pool:
    name: ${{ parameters.pool }}

  displayName: ${{ parameters.displayName }}

  steps:
  - task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@2
    displayName: 'Scan for Secrets'
    inputs:
      suppressionsFile: tools/credScan/suppress.json
      toolMajorVersion: V2
      debugMode: false

 


 


 


After adding the task, the pipeline will pass successfully only after passing CredScan task.


 


Summary


In this Part 1, we discussed the important of implementing first line of defense against credential leak by using CredScan client-side extension or CredScan task. In the next blog I will explore using AzSK to secure DevOps.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Submit a Comment